Skip to content

Commit

Permalink
Support offline scan option in trivy (#909)
Browse files Browse the repository at this point in the history 
Signed-off-by: He Weiwei <hweiwei@vmware.com>
  • Loading branch information
@heww
heww committed Jun 8, 2022
1 parent 58680c2 commit b64a6fa
Show file tree
Hide file tree
Showing 10 changed files with 66 additions and 0 deletions.
6 changes: 6 additions & 0 deletions apis/goharbor.io/v1beta1/harbor_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -467,6 +467,12 @@ type TrivyComponentSpec struct {
// The flag to enable or disable Trivy DB downloads from GitHub
SkipUpdate bool `json:"skipUpdate"`

// +kubebuilder:validation:Optional
// +kubebuilder:default=false
// Option prevents Trivy from sending API requests to identify dependencies.
// This option doesn’t affect DB download. You need to specify "skip-update" as well as "offline-scan" in an air-gapped environment.
OfflineScan bool `json:"offlineScan"`

// +kubebuilder:validation:Required
Storage HarborStorageTrivyStorageSpec `json:"storage"`
}
Expand Down
4 changes: 4 additions & 0 deletions apis/goharbor.io/v1beta1/trivy_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,10 @@ type TrivySpec struct {
// +kubebuilder:validation:Optional
// +kubebuilder:default="5m0s"
Timeout *metav1.Duration `json:"timeout,omitempty"`

// +kubebuilder:validation:Optional
// +kubebuilder:default=false
OfflineScan bool `json:"offlineScan"`
}

type TrivyUpdateSpec struct {
Expand Down
17 changes: 17 additions & 0 deletions charts/harbor-operator/templates/crds.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11314,6 +11314,13 @@ spec:
node''s labels for the pod to be scheduled on that node. More
info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
type: object
offlineScan:
default: false
description: Option prevents Trivy from sending API requests to
identify dependencies. This option doesn’t affect DB download.
You need to specify "skip-update" as well as "offline-scan"
in an air-gapped environment.
type: boolean
replicas:
description: 'Replicas is the number of desired replicas. This
is a pointer to distinguish between explicit zero and unspecified.
Expand Down Expand Up @@ -15707,6 +15714,13 @@ spec:
node''s labels for the pod to be scheduled on that node. More
info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
type: object
offlineScan:
default: false
description: Option prevents Trivy from sending API requests to
identify dependencies. This option doesn’t affect DB download.
You need to specify "skip-update" as well as "offline-scan"
in an air-gapped environment.
type: boolean
replicas:
description: 'Replicas is the number of desired replicas. This
is a pointer to distinguish between explicit zero and unspecified.
Expand Down Expand Up @@ -35007,6 +35021,9 @@ spec:
component to fit on a node. Selector which must match a node''s
labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
type: object
offlineScan:
default: false
type: boolean
proxy:
properties:
httpProxy:
Expand Down
1 change: 1 addition & 0 deletions controllers/goharbor/harbor/manifests/trivy/default-expected.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ metadata:
namespace: default
spec:
log: {}
offlineScan: false
redis:
database: 5
host: 127.0.0.1
Expand Down
1 change: 1 addition & 0 deletions controllers/goharbor/harbor/manifests/trivy/expose-core-with-tls-expected.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ metadata:
namespace: default
spec:
log: {}
offlineScan: false
redis:
database: 5
host: 127.0.0.1
Expand Down
1 change: 1 addition & 0 deletions controllers/goharbor/harbor/manifests/trivy/github-token-expected.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ metadata:
namespace: default
spec:
log: {}
offlineScan: false
redis:
database: 5
host: 127.0.0.1
Expand Down
1 change: 1 addition & 0 deletions controllers/goharbor/harbor/trivy.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -164,6 +164,7 @@ func (r *Reconciler) GetTrivy(ctx context.Context, harbor *goharborv1.Harbor, ha
CertificateInjection: harbor.Spec.Trivy.CertificateInjection,
Proxy: harbor.GetComponentProxySpec(harbormetav1.TrivyComponent),
Network: harbor.Spec.Network,
OfflineScan: harbor.Spec.Trivy.OfflineScan,
},
}, nil
}
1 change: 1 addition & 0 deletions controllers/goharbor/trivy/configs.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@ func (r *Reconciler) GetConfigMap(ctx context.Context, trivy *goharborv1.Trivy)
"SCANNER_TRIVY_SEVERITY": trivy.Spec.TrivySeverityTypes.GetValue(),
"SCANNER_TRIVY_IGNORE_UNFIXED": strconv.FormatBool(trivy.Spec.Server.IgnoreUnfixed),
"SCANNER_TRIVY_SKIP_UPDATE": strconv.FormatBool(trivy.Spec.Update.Skip),
"SCANNER_TRIVY_OFFLINE_SCAN": strconv.FormatBool(trivy.Spec.OfflineScan),
"SCANNER_TRIVY_INSECURE": strconv.FormatBool(trivy.Spec.Server.Insecure),

"SCANNER_STORE_REDIS_NAMESPACE": trivy.Spec.Redis.Namespace,
Expand Down
17 changes: 17 additions & 0 deletions manifests/cluster/deployment.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11333,6 +11333,13 @@ spec:
node''s labels for the pod to be scheduled on that node. More
info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
type: object
offlineScan:
default: false
description: Option prevents Trivy from sending API requests to
identify dependencies. This option doesn’t affect DB download.
You need to specify "skip-update" as well as "offline-scan"
in an air-gapped environment.
type: boolean
replicas:
description: 'Replicas is the number of desired replicas. This
is a pointer to distinguish between explicit zero and unspecified.
Expand Down Expand Up @@ -15731,6 +15738,13 @@ spec:
node''s labels for the pod to be scheduled on that node. More
info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
type: object
offlineScan:
default: false
description: Option prevents Trivy from sending API requests to
identify dependencies. This option doesn’t affect DB download.
You need to specify "skip-update" as well as "offline-scan"
in an air-gapped environment.
type: boolean
replicas:
description: 'Replicas is the number of desired replicas. This
is a pointer to distinguish between explicit zero and unspecified.
Expand Down Expand Up @@ -46340,6 +46354,9 @@ spec:
component to fit on a node. Selector which must match a node''s
labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
type: object
offlineScan:
default: false
type: boolean
proxy:
properties:
httpProxy:
Expand Down
17 changes: 17 additions & 0 deletions manifests/harbor/deployment.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11333,6 +11333,13 @@ spec:
node''s labels for the pod to be scheduled on that node. More
info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
type: object
offlineScan:
default: false
description: Option prevents Trivy from sending API requests to
identify dependencies. This option doesn’t affect DB download.
You need to specify "skip-update" as well as "offline-scan"
in an air-gapped environment.
type: boolean
replicas:
description: 'Replicas is the number of desired replicas. This
is a pointer to distinguish between explicit zero and unspecified.
Expand Down Expand Up @@ -15731,6 +15738,13 @@ spec:
node''s labels for the pod to be scheduled on that node. More
info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
type: object
offlineScan:
default: false
description: Option prevents Trivy from sending API requests to
identify dependencies. This option doesn’t affect DB download.
You need to specify "skip-update" as well as "offline-scan"
in an air-gapped environment.
type: boolean
replicas:
description: 'Replicas is the number of desired replicas. This
is a pointer to distinguish between explicit zero and unspecified.
Expand Down Expand Up @@ -35056,6 +35070,9 @@ spec:
component to fit on a node. Selector which must match a node''s
labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
type: object
offlineScan:
default: false
type: boolean
proxy:
properties:
httpProxy:
Expand Down

0 comments on commit b64a6fa

Please sign in to comment.